Silmaril CTO Weekly

The Bulletin On Tuesday morning, GitHub moved an AI security review command into the Copilot app, where a developer can ask for a scan of in-flight code before a pull request is ready. The next day, CISA added an Oracle E-Business Suite flaw and a KNX protocol flaw to its known-exploited catalog. A day later, Beacon Security announced a $13 million seed round for an agentic cyber-defense data layer. By Friday, arXiv was carrying fresh papers on multi-agent bottlenecks, AI coding prompt syntax, code-poisoning attacks, watermark failures, and visual tool use for scientific claim checking. The read for you is that the week did not move in one channel. It moved at the handoff between channels. Models are being trained to use tools, security vendors are trying to put checks inside the moment of work, and attackers keep aiming at the credentials and build systems that make tool use possible. For Silmaril, that makes the next product question narrower and more useful: which decision should be blocked, delayed, or recorded when an agent crosses from suggestion into action? The strongest source this week on that boundary came from OpenAI's GPT-Red release (company post), which described an internal automated red-team model trained by self-play to find prompt-injection failures. OpenAI said GPT-Red generated successful attacks against GPT-5.1 in 84 percent of scenarios in an internal mirror of an indirect-prompt-injection arena, compared with 13 percent for human red-teamers, and that adversarial training helped GPT-5.6 Sol reduce direct prompt-injection failures to 0.05 percent on a broad GPT-Red environment set. Treat the numbers as company claims until the promised preprint lands. Still, the frame matters. The frontier labs are no longer describing prompt injection as a static filter problem. They are turning attack search into a training loop. That is the opening tension for the week. If red-teamers can scale, defenders need a place to express authority, provenance, and revocation that survives the agent's chain of work. Where Checks Entered the Developer Loop GitHub's two July 14 changelog posts (product documentation) put AI security checks closer to the keyboard. The /security-review command in the Copilot app analyzes current changes, returns high-confidence findings, scores severity and confidence, and suggests fixes a developer can reverify without leaving Copilot. In a separate release, GitHub code scanning began surfacing AI-powered security detections directly on pull requests for GitHub Code Security customers. Those findings are labeled as AI, appear before merge, and are informational during preview rather than merge-blocking. The important product detail is the division of labor. GitHub is putting security in the same interface where code is being generated, edited, and reviewed, instead of asking the developer to upload an application to a separate scanner after the fact. That is a good distribution move, and it also makes the weakness visible. A finding that is informational, credit-metered, and dependent on platform policy is useful only after the tool has seen enough context and before the risky action has landed. OpenAI's GPT-Red release belongs in the same segment because it shows the upstream pressure on that workflow. Its examples describe prompt-injected data from webpages, emails, local files, tool responses, and code repositories. In one reported case study, GPT-Red attacked an office vending-machine agent through simulation and then transferred the attack to the live system, changing prices and canceling an order. The public page avoids publishing a turnkey exploit chain, which is appropriate, but the threat model is legible: real-world agents ingest hostile text through ordinary work surfaces and then call tools with consequences. Wiz's GhostApproval research from July 8 (vendor research, context) was outside this issue's source window, so it should play a supporting role. It still gives useful context for Tuesday's GitHub releases. Wiz reported a category-level trust-boundary flaw in six AI coding assistants, where symlinks and misleading approval prompts could make a user approve one apparent file operation while the agent affected a different target. Three vendors had fixed the issue at publication, according to Wiz, while other responses varied. For you, the durable lesson reaches beyond the symlink primitive: "human approval" can be a weak control when the approval surface hides the real object of the action. This is where Silmaril's opportunity gets sharper. A developer-side scanner helps only if the question is "does this diff look vulnerable?" A runtime firewall helps when the question is "does this action still match the authority the user meant to grant?" Those are neighboring markets, but they are not the same control point. This week, the platform vendors moved left into review. The harder problem remains the transition from reviewed intent to executed action. Research Tightened Around Tool Use The AI research feed this week was unusually aligned with that product question. "When Do Multi-Agent Systems Help?" (preprint) argues that multi-agent systems are best understood as an information-bottleneck problem. A single agent carries a full trace in one context. A multi-agent system breaks that trace into local contexts and bounded relay messages. The authors' 18 experiments suggest multi-agent designs help when relay messages preserve the task-relevant information while reducing redundant context, and hurt when compression loses the very facts the downstream worker needs. For Silmaril, that is a useful way to talk about policy. If an upstream agent summarizes a user's permission into a short instruction for a downstream tool-calling agent, the security system needs to know whether the permission survived the relay. A "yes" from a prior step is not enough. The control needs the scope of the yes, the object it applied to, and the point at which the action changed enough to require a fresh check. Another July 17 paper, "When Does Muon Help Agentic Reinforcement Learning?" (preprint), examined optimizer choice in sparse-reward agentic RL. The authors report that Muon, applied selectively to hidden weight matrices, improved validation success on ALFWorld under some advantage estimators and learning rates, including a jump from 0.290 to 0.546 in one matched comparison. They are careful about the limits: single-seed experiments, task-specific validation, and open cross-task questions. The relevance is still concrete. Post-training for agent behavior is starting to depend on engineering details that can change what an agent attempts, how quickly it learns, and which failure modes survive. "ActiveVision" (preprint) made a parallel point for multimodal systems. The benchmark asks vision-language models to repeatedly inspect images instead of answering from one static view. Frontier systems struggled badly, with the paper reporting 10.6 percent for GPT-5.5 at its highest exposed reasoning-effort tier and 3.5 percent for Claude Fable 5, while three humans averaged 96.1 percent. The authors say writing vision code did not close the gap because detecting the code's mistakes still required active perception. That matters because a large share of agent-security demos quietly assume the model understands the state it is acting on. ActiveVision says that assumption can fail in mundane perceptual loops. Tool use does not remove the need for observation. It creates a second problem: the system must know when the tool's output is decisive, when it is ambiguous, and when the agent is fabricating confidence around a brittle read. The scientific-claim-verification work from ToolSciVer (preprint) offers one constructive path. Its model uses type-aware visual tools for table focus, chart parsing, and high-resolution zoom, then trains tool-use behavior with reward terms for correctness, format validity, length control, efficient tool use, and valid tool calls. Even if the result is early, the design is pointed in the right direction. It rewards the agent for answering and for using the right evidence instrument in the right way. CRAFT (preprint), another July 17 paper, turns rubrics into capability diagnoses and targeted fine-tuning data. Instead of saying a model failed a prompt category, it extracts rubric criteria as capability probes, clusters them into a tree, and generates training data for the weak nodes. Read alongside ToolSciVer, the research direction is clear. Better evals are becoming repair systems. For Silmaril, the analogue is finding the narrow capability or policy failure behind a bad tool call, then improving either the model behavior or the enforcement rule without flattening every action into a generic block. The Security Papers Were About Evidence, Not Just Refusal Several security papers in the window pushed against shallow safety signals. "AI Watermark Evidence Fails Forensic Readiness" (preprint) tested representative watermarking methods against forensic criteria and paraphrase attacks. The authors report that every initially detected KGW and Unigram text lost its watermark after meaning-preserving paraphrase, with SynthID losing detection in 98.3 percent of comparable cases. They also found high false-negative rates before attack. Their legal framing is ambitious, and watermark implementations vary, but the practical message is hard to ignore. A detector that cannot preserve evidence through normal transformation is weak support for an enforcement decision. "Refusal is Not Safety!" (preprint) made a related point through humorized refusals. The authors studied more than 30,000 real-world agent interaction records and built HumorSafe and HumorPIA to test whether apparently safe humorous responses could carry latent harmful content. They report a 3.14 times toxicity increase while maintaining a 97.8 percent apparent safety rate under defense settings. The phrase in the title is blunt, but the finding is useful. A safe-looking response can still be an unsafe carrier if the evaluation watches form and misses payload. The code-generation paper on prompt syntax (preprint, accepted at ICSME 2026) is more directly operational. It reports that fine-grained syntactic elements in security prompts, including constraints, guards, conditions, concept bindings, and their position, can consistently affect whether open LLMs generate insecure code. That is uncomfortable for product teams because it turns prompt wording into a security control surface. It is also an opening. If syntax changes risk, then policy compilers, prompt templates, and tool-call wrappers need tests at the level of individual phrasing choices, not just high-level intent labels. The code-poisoning property-inference paper (preprint) widened the aperture from generated code to borrowed code. It describes a scenario where malicious code from hosting platforms or coding agents embeds properties into secret samples during training, later leaking information through a label-only model API. The authors claim 100 percent attack accuracy across their evaluated settings without degrading model accuracy. As with any preprint, you should wait for independent replication before treating the result as field prevalence. The product read is immediate anyway. Agent-written or agent-recommended code can become part of a training or deployment pipeline, where the harm may appear later and outside the original session. That sequence should influence this week's research priorities. Do not evaluate Silmaril only on whether it blocks an obviously malicious prompt. Test whether it preserves evidence after summarization, resists safe-looking wrappers, records the exact authority boundary around code changes, and detects when a downstream artifact is being used in a new security context. Supply Chain and Infrastructure Kept the Floor Moving The week also brought a concrete supply-chain incident. Wiz's July 14 AsyncAPI report (vendor research) says an attacker opened 37 pull requests against the AsyncAPI generator repository, used a misconfigured pullrequesttarget workflow to steal a privileged personal access token, and then published four malicious npm packages across five versions under the @asyncapi namespace. Wiz estimated the affected packages together see more than three million weekly downloads. The payload executed on import or require, established persistence, and targeted browser credentials, SSH keys, npm and GitHub tokens, cloud credentials, macOS Keychain data, and crypto wallets. This compromise was broader than AI, and it hit exactly the kind of substrate agentic development depends on. Agents clone repositories, read package files, run build steps, and propose CI changes. The risky object is no longer just the package. It is the workflow plus the bot token plus the agent that may confidently explain why a small PR is harmless. Security that begins only at runtime is late for this class of incident. Security that ends at static dependency reputation is also thin, because the damaging step can be a privileged workflow executing untrusted code. CISA's July 15 KEV alert (government advisory) added two actively exploited vulnerabilities: CVE-2023-4346 in KNX Association KNX Protocol Connection Authorization Option 1 and CVE-2026-46817 in Oracle E-Business Suite. The agency tied the entries to Binding Operational Directive 26-04, which prioritizes remediation of KEV-listed vulnerabilities on exposed assets that grant access to critical services or sensitive data. For you, the reminder is that AI security will still be bought inside ordinary vulnerability-management budgets. A firewall story that ignores asset exposure, privilege, and remediation priority will sound detached from how security teams are measured. The deep-tech research beat reinforced the same infrastructure theme from a different angle. A Communications Physics review on maximum-clique algorithms (peer-reviewed review) surveyed classical, AI, and quantum methods for a problem that shows up in optimization and graph analysis. Science published work on robust single-electron memory (peer-reviewed) and a phase microscope for quantum gases (peer-reviewed). A July 17 5G paper on DoSQ (preprint, accepted at IEEE CNS) described a cross-layer attack that infers application goodput from downlink control information and selectively jams physical resource blocks, degrading a YouTube Live target by up to 50 percent in a private 5G testbed. None of these are direct GTM items for Silmaril this week. Together, they are a reminder that the next security product buyer will be operating across software, radios, accelerators, and weird hardware-adjacent systems where model output is only one piece of the control surface. Google Research's diffusion-model post (research blog with linked paper) fits here too. It argues that diffusion model creativity can arise from learning a smoothed score function that interpolates along a hidden data manifold, rather than merely memorizing training examples. The practical consequence is that model behavior can be lawful without being easy to predict from examples. For security, that cuts both ways. Generative systems can produce useful novelty, and they can also generate variants of risky behavior that no static blocklist has seen. Startups Moved Toward Agent Control Planes Beacon Security's July 16 funding announcement (company announcement) is the cleanest startup signal in the window. The company raised a $13 million seed round led by Notable Capital and says it grew ARR more than 300 percent in the first half of 2026. Its pitch is an agentic cybersecurity work platform with a trustworthy data layer so human and AI agents can defend organizations together. The exact product claims need customer-level validation, but the positioning is important. "Agentic SOC" is becoming a funding category, and the claimed buyer pain is fragmented security data that agents cannot reliably act on. Traceforce's July 16 Launch HN thread and open-source mcp-xray repository (founder launch post and GitHub repository) point at the endpoint side of the same problem. The founders describe company-wide monitoring for AI apps on devices, including how apps connect to data sources through MCP, and the repository advertises dynamic testing for MCP vulnerabilities such as code execution, SSRF, path traversal, authorization bypass, input injection, information disclosure, and denial of service. A Hacker News launch is a weaker source than a customer announcement, but it is a timely artifact from a YC S26 company building where Silmaril is already looking: the moment tools and connectors create new authority paths. Fabraix's YC profile (company directory) adds a different competitive angle. The company describes Nyx as an autonomous testing harness for AI agents and claims a 78 percent attack success rate on AgentHarm, compared with 67 percent for GPT-5.6 Sol. It also says its agent has found vulnerabilities in agents at dozens of Fortune 500 companies. Those are company claims, and the benchmark comparison needs scrutiny. Still, the direction is useful. Emerging competitors are not only selling dashboards. They are selling continuous adversarial verification against changing agents. That should sharpen Silmaril's GTM language this week. The market is hearing several adjacent offers: agentic SOC data layers, endpoint visibility into AI apps and MCP, autonomous red-team agents, AI-powered code review, and model-provider robustness training. Silmaril needs to be crisp about the missing piece it owns. The strongest version is a live authorization layer for AI actions, one that understands intent, tool authority, evidence, and revocation at the moment an agent is about to do something consequential. Monday Operating Read Carry three decisions into the week. First, make the product demo prove a boundary, not a vibe. Show an agent that has permission to summarize, then tries to write, exfiltrate, or change a setting after hostile context enters the loop. The reveal should be the preserved authority boundary and the recorded reason for the decision. Second, test against transformations. Run prompts through summaries, humorous wrappers, tool outputs, code comments, and multi-agent relays. If a policy only works on the original text, it will look better in a demo than it behaves in production. Third, treat competitors by control point. GitHub is moving checks into developer review. OpenAI is scaling red-team training. Beacon, Traceforce, and Fabraix are circling agentic security operations, endpoint visibility, and adversarial verification. Silmaril's edge is strongest where those systems still have to ask whether a live action should proceed. That is a narrow week, which is good. The noise is broad. The work is to make the authorization moment unmistakable. Sources OpenAI, "GPT-Red: Unlocking Self-Improvement for Robustness," July 15, 2026. https://openai.com/index/unlocking-self-improvement-gpt-red/ GitHub, "Security reviews now available in the GitHub Copilot app," July 14, 2026. https://github.blog/changelog/2026-07-14-security-reviews-now-available-in-the-github-copilot-app/ GitHub, "Code scanning shows AI security detections on pull requests," July 14, 2026. https://github.blog/changelog/2026-07-14-code-scanning-shows-ai-security-detections-on-pull-requests/ Wiz, "M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions," July 14, 2026. https://www.wiz.io/blog/m-red-team-asyncapi-supply-chain-compromise-via-github-actions Wiz, "GhostApproval: A Trust Boundary Gap in AI Coding Assistants," July 8, 2026. https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants Google Research, "Towards demystifying the creativity of diffusion models," July 15, 2026. https://research.google/blog/towards-demystifying-the-creativity-of-diffusion-models/ Kai Ruan et al., "When Does Muon Help Agentic Reinforcement Learning?" July 17, 2026. https://arxiv.org/abs/2607.16169 Wendi Yu et al., "When Do Multi-Agent Systems Help? An Information Bottleneck Perspective," July 17, 2026. https://arxiv.org/abs/2607.16133 Jiarui Zhang et al., "An Exam for Active Observers," July 17, 2026. https://arxiv.org/abs/2607.16165 Binglin Zhou et al., "ToolSciVer: Multimodal Scientific Claim Verification with Visual Tool Augmented Reinforcement Learning," July 17, 2026. https://arxiv.org/abs/2607.16131 Vipul Gupta et al., "CRAFT: Clustering Rubrics to Diagnose Weak LLM Capabilities and Generate Targeted Fine-Tuning Data," July 17, 2026. https://arxiv.org/abs/2607.16122 Saifur Rahman Tamim and Amir Labib Khan, "AI Watermark Evidence Fails Forensic Readiness," July 17, 2026. https://arxiv.org/abs/2607.16010 Yu Cui et al., "Refusal is Not Safety! Benchmarking Latent Safety Risks of LLM-Driven Content Humorization," July 17, 2026. https://arxiv.org/abs/2607.15977 Xukun Luan et al., "Code-Poisoning Property Inference Attacks," July 17, 2026. https://arxiv.org/abs/2607.15970 Matteo Cicalese et al., "The Language of Security: How Prompt Syntax Shapes Secure Code Generation in Open LLMs," July 17, 2026. https://arxiv.org/abs/2607.15937 Mahmudul Hassan Ashik and Moinul Hossain, "DoSQ: A Cross-Layer Denial of Service Quality Attack by Exploiting Side Channels in 5G NR," July 17, 2026. https://arxiv.org/abs/2607.16102 Raffaele Marino et al., "A short review on the maximum clique problem algorithms with classical, AI, and quantum methods," July 16, 2026. https://www.nature.com/articles/s42005-026-02606-7 Science, "Robust single-electron memory with quantum states manipulation," July 16, 2026. https://www.science.org/doi/abs/10.1126/science.aeg6638 Science, "A phase microscope for quantum gases," July 2026. https://www.science.org/doi/10.1126/science.adt1712 CISA, "CISA Adds Two Known Exploited Vulnerabilities to Catalog," July 15, 2026. https://www.cisa.gov/news-events/alerts/2026/07/15/cisa-adds-two-known-exploited-vulnerabilities-catalog Beacon Security, "Beacon Security Raises $13 Million in Seed Funding to Give AI Agents a Trustworthy Data Foundation for Cyber Defense," July 16, 2026. https://beacon.security/resources/beacon-security-raises-13-million-in-seed-funding-to-give-ai-agents-a-trustworthy-data-foundation-for-cyber-defense Traceforce, "mcp-xray," July 2026. https://github.com/traceforce/mcp-xray Y Combinator, "Fabraix: The world's frontier hacker for AI agents," July 2026. https://www.ycombinator.com/companies/fabraix